4 ms·
I'm not sure this is very fair because humans are often not given the right tools to make a good decision. For example: To gift to a 529 regardless of the fin
by aeternum 11mo ago
I'm not sure this is very fair because humans are often not given the right tools to make a good decision. For example:
To gift to a 529 regardless of the financial institution, you go to some random ugift529.com site and put in a code plus all your financial info. This is considered the gold standard.
To get a payout from a class-action lawsuit that leaked your data, you must go to some other random site (usually some random domain name loosely related to the settlement recently registered by kroll) and enter basically more PII than was leaked in the first place.
To pay your fed taxes with a credit card, you must verify your identity with some 3rd party site, then go to yet another 3rd party site to enter your CC info.
This is insane and forces/trains people to perform actions that in many other scenarios lead to a phishing attack.
- thewebguyd 11mo agoDon't forget magic links in email for auth and password resets training people that it's OK to click links in emails. Yes, we've (the software industry) been training people to practice poor OpSec for a very long time, so it's not surprising at all that corporate cybersecurity training is largely ineffective. We violate our own rules all the time
- wholinator2 11mo agoHas anyone invented an alternative to that yet? I could imagine emailing you a code to enter in a specific part of a site to get you to the right link, but then people could just scan all the codes. To solve that you could make the codes long 64bit strings but then that's too hard to remember so you could just provide functionality to automatically include that info to get you to the site but then that's just a link again. Maybe if you expected everyone to copy-paste the info into the form? That might work
- aeternum 11mo agoThis is the closest I've seen (pretty new): https://github.com/WICG/email-verification-protocol https://github.com/WICG/email-verification-protocol
- rapind 11mo agoI recently discovered that Microsofts SSO doesn't guarantee email veracity. Basically you can spoof emails via ActiveDirectory, so if a site supports Microsoft's SSO and doesn't do a second verification, then someone could login to your site with someone else's email. I mean, what's the point of their SSO if you're just going to need to verify it with an email code anyways?
- miiiiiike 11mo agoIt’s easier/more complicated than that. Use 6 digit codes, tied to a specific reset session, with only 3 attempts allowed per-session, and sessions lasting only 5 minutes.
- kakacik 11mo agoDon't allow HTML rendering of <a> element where href links to another URL than shown, don't allow any (java)scripts to run, or at least give user a warning that he is about top open a new window into domain XYZ. This is how I found out quite a few scams (apart from obvious ones with improper wording or visual formatting, but those are on purpose so bad to catch only most unskilled or gullible, ie your grandma)
- Razengan 11mo agoThere should be a way to tell you who I am without telling you who I am. Phone/laptop based biometrics?
- thewebguyd 11mo agoI think this is the way forward. We shouldn't continue relying on email (or proving ownership over an email address for that matter) as identity. Public/private keys with a second factor (like biometrics) as identity I think is a good option. A way to announce who you are, without actually revealing your identity (or your email address). Tbh that's how all the age verification crap should work too for the countries that want to go down that road instead of having people upload a copy of their actual ID to some random service that is 100% guaranteed going to get breached and leaked. We need psuedoanonymous verification
- disillusioned 11mo agoIsn't that what a passkey is intended to be? If I want to use a passkey on my phone, I have to bio authenticate into it. Similarly, with Windows Hello as a passkey provider, via my camera scanner. It works well and is pretty seamless, all things considered. I prefer it to the email/code/magic link method.
- DANmode 11mo agoIt’s how I’ve been using physical keys over the same protocol for years, mhmm.
- edoceo 11mo agopGP signature?
- dredmorbius 11mo agoAn unblemished 34 year record of failing mainstream adoption. (I've had at least one PGP/GPG key for the past quarter century or so myself.)
- 11mo ago
- deleted 11mo ago[deleted]
- Sophira 11mo agoAbout 10 years ago, I got an email from Microsoft of all people(!) which to any reasonably security-trained person would look entirely like a phishing email:[0] 1. It said "Dear User" instead of a name/username; 2. It talked about how they were upgrading their forum software and as such would require me to re-login; 3. It gave me a link to click in the email without any stated alternative; 4. It warned me that if I didn't do this, I would no longer be able to access the forum; 5. The domain of the URL that the link went to was not microsoft.com, but a different domain that had "microsoft" in it. It was a textbook example for how a phishing email would look, and yet it was actually a legitimate email from Microsoft! I haven't had any others like it since, but that was an eye-opener for sure. [0] https://reddit.com/r/facepalm/comments/32ou4z/microsoft_what_happened_to_telling_people_not_to/ https://reddit.com/r/facepalm/comments/32ou4z/microsoft_what... [Edit: Fixed a detail I misremembered.]
- aidenn0 11mo agoDon't forget credit checks when you apply for an apartment! "Go to this website sent via e-mail from someone you only know through a craigslist ad and enter all of your PII. On top of that about 2/3 of what is listed actually is phishing attempts and good luck telling the difference"
- DANmode 11mo agoIf you apply to living spaces before viewing after emailing or calling, well, no wonder they’re after you as a demographic.
- aidenn0 11mo agoLike when you suddenly have to move to a different city due to an unexpected job change and are trying to schedule as many viewings in one weekend as possible?
- maest 11mo agoThis is very much a US issue, largely because the government outsources everything to the private sector. This proliferation of random websites and shady 3rd parties is one of the consequences of this.